mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-11-04 13:30:12 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

pulse-server: free pending sample reply

Browse source 
If the sample finished playing before we finished the roundtrip to
get the sink_index, it will be destroyed. When the roundtrip completes,
it will try to use invalid memoryy and crash.

Make sure we destroy all pending replies before destroying the sample
to avoid this problem.

Fixes #2151
This commit is contained in:
Wim Taymans 2022-02-20 21:34:53 +01:00
parent bf9ef440c3
commit d7793501fd
4 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/modules/module-protocol-pulse/pending-sample.c
View file

@ -29,6 +29,7 @@
#include "client.h"
#include "internal.h"
#include "log.h"
#include "operation.h"
#include "pending-sample.h"
#include "sample-play.h"
@ -36,10 +37,14 @@ void pending_sample_free(struct pending_sample *ps)
{
struct client * const client = ps->client;
struct impl * const impl = client->impl;
struct operation *o;
spa_list_remove(&ps->link);
spa_hook_remove(&ps->listener);
pw_work_queue_cancel(impl->work_queue, ps, SPA_ID_INVALID);
if ((o = operation_find(client, ps->tag)) != NULL)
operation_free(o);
sample_play_destroy(ps->play);
}